Service chaining allows network operators to steer traffic for a given application through various appliances, such as firewalls, WAN optimizers, and Intrusion Prevention Systems (IPSs), which together enforce specific policies and provide a desired functionality for the traffic. The appliances in a service chain can be “chained” together in a particular sequence along the path of the traffic to process the traffic through the sequence of appliances. For example, a network operator may define a service chain including a firewall and a WAN optimizer for traffic associated with an application. When such traffic is received, it is first routed to the firewall in the service chain, which provides firewall capabilities such as deep packet inspection and access control. After the traffic is processed by the firewall, it is routed to the WAN optimizer in the service chain, which can compress the traffic, apply quality-of-service (QoS) policies, or perform other traffic optimization functionalities. Once the traffic is processed by the WAN optimizer, it is routed towards its intended destination.
To implement a service chain, the network operator can program rules or policies for redirecting an application's traffic through a sequence of appliances in the service chain. For example, the network provider can program an access control list (ACL) in the network device's hardware, such as the network device's Ternary Content Addressable Memory (TCAM). The ACL can include entries which together specify the sequence of appliances in the service chain for the application's traffic. The ACL entries can identify specific addresses associated with the application's traffic, such as origin or destination IP addresses associated with the application's traffic, which the network device can use to match an ACL entry to traffic. The network device can then use the ACL entries to route the application's traffic through the sequence of appliances in the service chain.
Unfortunately, however, programming service chains on the network device for each IP allocated to a cloud provider or service can be prohibitive. Cloud providers typically have a very large number of IP addresses allocated for their domains and services. Moreover, the hardware capacity (e.g., TCAM capacity) on a network device is limited and typically insufficient to implement service chains for each cloud provider IP. This problem is compounded when dealing with inter-cloud traffic which involves an even higher number of IP addresses from both the origin and destination clouds, thus increasing the number of service chain entries necessary to program service chains for the inter-cloud traffic. As a result, network devices generally lack the hardware capacity to implement service chains for each origin and destination cloud IP. Consequently, network operators are frequently unable to program service chains on a network device based on the origin and destination clouds of inter-cloud traffic.